Xls.Trojan.Sugar — Office (OLE) / .XLSX malware analysis

Static analysis result for SHA-256 eb7144f891cc0f7c…

MALICIOUS

Office (OLE) / .XLSX

46.0 KB Created: 2005-11-22 07:19:39 Authoring application: Microsoft Excel
MD5: a03d62af3e364909553ec67e05d9d26b SHA-1: 0d037fd1cfca821e7ed349089a004e790e9e8ea0 SHA-256: eb7144f891cc0f7c382b8554d4160eb65a8963a793568ee629440c593954f709
200 Risk Score

Malware Insights

Xls.Trojan.Sugar · confidence 90%

MITRE ATT&CK
T1059.005 Visual Basic T1140 Deobfuscate or Decode Files or Information

The sample is an Excel spreadsheet with a high-confidence verdict of malicious. It contains VBA macros, including an Auto_Close macro, which are known to be used for malicious purposes. The script attempts to export itself to the C drive and potentially create a copy in the startup path, indicating an attempt at persistence and propagation. The ClamAV detection of 'Xls.Trojan.Sugar-3' further supports its classification as a known trojan.

Heuristics 5

  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
dfe36bea770984a9bf9ad33a8cc5e909920378e4a6bf79d7128840c22478bdb9		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 67498 bytes
Detection
ClamAV: Xls.Trojan.Sugar-3
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.